Topic starter
23/06/2026 7:11 pm
TL;DR: Domain name scams use fake invoices, renewal notices, appraisal requests, and transfer pressure to trick businesses into paying fraudsters or handing over control of a legitimate domain, according to DigiCert. The pattern matters because the attack succeeds by exploiting trust in domain identity, not just email hygiene.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Common Domain Name Scams and How to Avoid Them”.
Key questions
Q: How should security teams verify domain renewal requests before paying them?
A: Teams should verify every domain renewal request by going directly to the registrar portal, checking the account status, and confirming the request with a known internal owner before any payment is approved.
Q: Why do fake domain invoices and renewal notices create real security risk?
A: Because they target the control point where a routine business payment can become a registrar transfer or ownership change.
Q: What are the signs that a domain scam is trying to hijack ownership?
A: Urgent language, inflated renewal fees, unfamiliar registrar names, demands to transfer quickly, and requests for payment or appraisal through a specific service are common warning signs.
Practitioner guidance
- Verify registrar legitimacy out of band Confirm renewal or transfer notices by logging into the registrar directly or using a known contact channel.
- Lock down transfer authority Enable domain locking and require explicit approval before any registrar change, ownership update, or transfer request is processed.
- Maintain an authoritative domain inventory Keep a current list of registered domains, renewal dates, registrar accounts, and approved administrators so staff can quickly spot a fraudulent request that targets the wrong asset.
Bottom line: Domain scams exploit trusted administrative workflows, which makes them an identity control issue as well as a fraud issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:04 am
Domain name scams are an identity governance problem, not just a fraud problem. The core weakness is that organisations often treat registrar communication as routine admin rather than a control point. That assumption fails when a message can trigger payment, transfer, or ownership change without strong verification. Practitioners should treat domain authority as part of the digital identity estate, with explicit governance around who can approve change and how legitimacy is checked.
A question worth separating out:
Q: Should organisations use domain locking and MFA for registrar accounts?
A: Yes. Domain locking helps prevent unauthorised transfer or hijacking, while MFA reduces the chance that a stolen password or phishing lure can be used to change registrar settings. Both controls matter because domain administration is a high-impact identity workflow, not a low-risk back-office task.
👉 Read our full editorial: Domain name scams expose the gap in digital identity controls